iqingshan/blackash-cve-2025-53833CVE-2025-53833
This vulnerability allows unauthenticated attackers to:
.env containing database passwords, API keys, and secretsNo prior authentication or user interaction is required.
The flaw lies in how LaRecipe renders documentation templates. Malicious input is not properly sanitized before being passed into the templating engine, leading to full control over the rendering logic—hence, code execution.
Example:
An attacker could inject something like {{ system('id') }} into a template-rendering route and execute OS-level commands.
To protect your system:
Upgrade immediately to LaRecipe version 2.8.1 or later
If you cannot upgrade:
Monitor server logs for suspicious activity, especially access to documentation routes
Review .env and other sensitive files for unauthorized access or changes
| Category | Info |
|---|---|
| Type | SSTI → RCE |
| Scope | Unauthenticated users |
| Exploitable via | Public documentation endpoints |
| Patch | Upgrade to 2.8.1+ |
| Urgency | Critical – patch immediately |
This information is provided for educational and defensive purposes only. Exploiting vulnerabilities without proper authorization is illegal and unethical. Always ensure you have explicit permission before conducting any form of security testing. The author is not responsible for any misuse of the content provided.